Description

Ensure that every Amazon Elastic File System (EFS) file system has encryption at rest enabled. With encryption at rest, EFS encrypts file data and metadata stored in the file system using an AWS Key Management Service (AWS KMS) key.

Rationale

Without encryption at rest, file system contents are not protected by a KMS key, so access to the data cannot be controlled or audited through key policies and key usage logs. This weakens confidentiality and can make it easier to read or copy data offline after a compromise. Encryption at rest can only be enabled when a file system is created, so existing unencrypted data must be migrated to a new encrypted file system. A customer managed KMS key gives more control over key access and rotation.

Impact

  • Protects file data and metadata at rest with AWS KMS encryption

  • Requires creating a new file system and migrating data, which needs a maintenance window to switch clients to the new file system

  • Using a customer managed KMS key adds key management effort and KMS request costs

Default Value

When a file system is created in the Amazon EFS console, encryption at rest is enabled by default. When a file system is created through the API or AWS CLI, encryption at rest is not enabled unless it is requested.

Pre-Requisites

  • IAM permissions: elasticfilesystem:DescribeFileSystems, elasticfilesystem:CreateFileSystem, elasticfilesystem:CreateMountTarget, elasticfilesystem:DeleteFileSystem, plus kms:DescribeKey and kms:CreateGrant on the KMS key

  • A method to copy the data, such as AWS DataSync or a copy from an instance that mounts both file systems

  • A maintenance window to move clients to the new file system

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EFS console and select File systems.

  3. Check the Encrypted column for each file system.

  4. Repeat for each region in use.

  5. If any file system is not encrypted, follow the implementation steps.

CLI:

List all file systems with their encryption setting:

aws efs describe-file-systems --region <REGION> --query "FileSystems[].[FileSystemId,Name,Encrypted,KmsKeyId]" --output table

A file system fails if Encrypted is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EFS console and choose Create file system, then Customize.

  3. Keep Enable encryption of data at rest selected and choose the default key or a customer managed KMS key.

  4. Configure the network access, mount targets and file system policy to match the existing file system, then choose Create.

  5. Copy the data from the unencrypted file system to the new one, for example with AWS DataSync.

  6. Update clients, task definitions and mount configurations to use the new file system.

  7. After confirming the data and applications, delete the unencrypted file system.

  8. Repeat for each affected file system in each region in use.

Backout Plan

Keep the unencrypted file system until the new one has been fully verified.

  1. Update clients, task definitions and mount configurations to use the original file system again.

  2. Copy back any data that was written only to the new file system.

  3. Delete the new encrypted file system if it is no longer needed.

Note: rolling back leaves the data without encryption at rest. Once the original file system is deleted, rollback is no longer possible.

Reference